@uns-kit/cli 3.0.10 → 3.0.12

package/dist/index.js

@@ -492,7 +492,7 @@ async function initGitRepository(targetDir) {
 const DEFAULT_UNS_DATAHUB_ADDON_METADATA = {
     schemaVersion: 1,
     kind: "addon",
-    controllerCompatibility: ">=7.1 <8",
+    controllerCompatibility: ">=2 <3",
 };
 function ensureUnsDatahubAddonMetadata(pkg) {
     if (pkg.unsDatahub !== undefined) {
@@ -530,6 +530,7 @@ const AGENT_MIGRATION_BLOCK = [
     "- When crossing `<2.0.71` to `>=2.0.71`, inspect MQTT proxy ownership and follow the documented shutdown migration. Process-owned and standalone proxies have different shutdown paths.",
     "- When crossing `<3.0.0` to `>=3.0.0`, migrate MQTT `message.table.columns` publishers from named arrays to named objects and consumers to object-entry iteration. Keep schema `tableColumns` and Assistant/UI table formats unchanged.",
     "- When crossing `<3.0.7` to `>=3.0.7`, update the application's direct `zod` dependency to Zod 4, migrate Zod-3-only project config extension APIs, and regenerate `config.schema.json` plus `src/config/app-config.ts`.",
+    "- When crossing `<3.0.11` to `>=3.0.11` for an OpenHub 2.x add-on, replace the old `>=7.1 <8` manifest range with `>=2 <3` only after compatibility validation, then use the three credential-free runtime profiles and `ServiceTokenProvider` guidance in `MIGRATIONS.md`.",
     AGENT_MIGRATION_END,
 ].join("\n");
 async function ensureAgentMigrationGuidance(targetDir) {
@@ -1710,15 +1711,21 @@ async function replacePlaceholders(targetDir, packageName) {
         __APP_NAME__: packageName,
         __APP_CONFIG__: deriveConfigIdentifier(configFilePath),
     };
+    const profileFiles = [
+        configFilePath,
+        path.join(targetDir, "config-development-host.json"),
+        path.join(targetDir, "config-development-podman.json"),
+        path.join(targetDir, "config-production.json"),
+    ];
     const filesToUpdate = [
         path.join(targetDir, "README.md"),
         path.join(targetDir, "src/index.ts"),
-        configFilePath,
+        ...profileFiles,
     ];
     for (const file of filesToUpdate) {
         try {
             await access(file);
-            if (path.resolve(file) === path.resolve(configFilePath)) {
+            if (profileFiles.some(profileFile => path.resolve(file) === path.resolve(profileFile))) {
                 await replaceConfigTemplatePlaceholders(file, replacements, packageName);
                 continue;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uns-kit/cli",
-  "version": "3.0.10",
+  "version": "3.0.12",
   "description": "Command line scaffolding tool for UNS applications",
   "type": "module",
   "license": "MIT",
@@ -26,14 +26,14 @@
   ],
   "dependencies": {
     "azure-devops-node-api": "^15.1.2",
-    "@uns-kit/core": "3.0.10"
+    "@uns-kit/core": "3.0.12"
   },
   "unsKitPackages": {
-    "@uns-kit/core": "3.0.10",
-    "@uns-kit/api": "3.0.10",
-    "@uns-kit/cron": "3.0.10",
-    "@uns-kit/database": "3.0.10",
-    "@uns-kit/assistant-workflow": "3.0.10"
+    "@uns-kit/core": "3.0.12",
+    "@uns-kit/api": "3.0.12",
+    "@uns-kit/cron": "3.0.12",
+    "@uns-kit/database": "3.0.12",
+    "@uns-kit/assistant-workflow": "3.0.12"
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",

package/templates/config-files/{config-localhost.json → config-development-host.json}

@@ -15,21 +15,9 @@
     "handover": true,
     "jwksWellKnownUrl": "http://localhost:3200/api/.well-known/jwks.json",
     "kidWellKnownUrl": "http://localhost:3200/api/.well-known/kid",
-    "email": "user@example-org.com",
-    "password": "secret"
+    "env": "dev"
   },
   "infra": {
     "host": "localhost"
-  },
-  "output": {
-    "host": "localhost"
-  },
-  "input": {
-    "host": "localhost"
-  },
-  "devops": {
-    "provider": "azure-devops",
-    "organization": "example-org",
-    "project": "example-project"
   }
 }

package/templates/config-files/config-development-podman.json

@@ -0,0 +1,23 @@
+{
+  "uns": {
+    "graphql": "http://localhost:3200/graphql",
+    "rest": "http://localhost:3200/api",
+    "processName": "__APP_NAME__",
+    "supervisor": {
+      "enabled": false,
+      "restartOnExit": false,
+      "maxMemoryMb": 512,
+      "restartOnUnhealthy": false,
+      "unhealthyAfterMs": 60000,
+      "restartCooldownMs": 300000
+    },
+    "instanceMode": "wait",
+    "handover": true,
+    "jwksWellKnownUrl": "http://localhost:3200/api/.well-known/jwks.json",
+    "kidWellKnownUrl": "http://localhost:3200/api/.well-known/kid",
+    "env": "dev"
+  },
+  "infra": {
+    "host": "mosquitto"
+  }
+}

package/templates/config-files/config-production.json

@@ -0,0 +1,23 @@
+{
+  "uns": {
+    "graphql": "http://localhost:3200/graphql",
+    "rest": "http://localhost:3200/api",
+    "processName": "__APP_NAME__",
+    "supervisor": {
+      "enabled": false,
+      "restartOnExit": false,
+      "maxMemoryMb": 512,
+      "restartOnUnhealthy": false,
+      "unhealthyAfterMs": 60000,
+      "restartCooldownMs": 300000
+    },
+    "instanceMode": "wait",
+    "handover": true,
+    "jwksWellKnownUrl": "http://localhost:3200/api/.well-known/jwks.json",
+    "kidWellKnownUrl": "http://localhost:3200/api/.well-known/kid",
+    "env": "prod"
+  },
+  "infra": {
+    "host": "mosquitto"
+  }
+}

package/templates/default/.env.example

@@ -0,0 +1,9 @@
+# Used only by a directly started host-development process with
+# config-development-host.json. Controller-managed Podman and production
+# instances receive UNS_SERVICE_TOKEN_FILE automatically.
+UNS_SERVICE_TOKEN=replace-with-development-machine-token
+
+# Required for direct host development so API route metadata identifies the
+# local controller. Controller-managed instances receive these values from PM2.
+UNS_CONTROLLER_NAME=controller-local
+UNS_CONTROLLER_PUBLIC_BASE=http://localhost:3200

package/templates/default/AGENTS.md

@@ -29,5 +29,6 @@ Pointers for AI/code-assist tools when working in this generated project.
 - When crossing `<2.0.71` to `>=2.0.71`, inspect MQTT proxy ownership and follow the documented shutdown migration. Process-owned and standalone proxies have different shutdown paths.
 - When crossing `<3.0.0` to `>=3.0.0`, migrate MQTT `message.table.columns` publishers from named arrays to named objects and consumers to object-entry iteration. Keep schema `tableColumns` and Assistant/UI table formats unchanged.
 - When crossing `<3.0.7` to `>=3.0.7`, update the application's direct `zod` dependency to Zod 4, migrate Zod-3-only project config extension APIs, and regenerate `config.schema.json` plus `src/config/app-config.ts`.
+- When crossing `<3.0.11` to `>=3.0.11` for an OpenHub 2.x add-on, replace the old `>=7.1 <8` manifest range with `>=2 <3` only after compatibility validation, then use the three credential-free runtime profiles and `ServiceTokenProvider` guidance in `MIGRATIONS.md`.
 
 <!-- uns-kit:migrations:end -->

package/templates/default/README.md

@@ -18,7 +18,19 @@ pnpm run sync-uns-metadata -- --controller-url http://localhost:3200 --token <me
 
 ## Configuration
 
-Update `config.json` with your broker, UNS URLs, and credentials. The generated file contains sensible defaults for local development. If you use a service token, add `uns.token` and pass it to `UnsClient`.
+The generator provides three committed, credential-free runtime profiles. Copy
+the appropriate profile to the untracked `config.json` before running the app:
+
+| Profile | Use it when | MQTT | Service credential |
+|---|---|---|---|
+| `config-development-host.json` | Running `pnpm run dev` directly on the host | `localhost` | `.env` → `UNS_SERVICE_TOKEN` |
+| `config-development-podman.json` | Deploying through a local Podman OpenHub controller | `mosquitto` | Controller-managed `UNS_SERVICE_TOKEN_FILE` |
+| `config-production.json` | Creating a production controller instance | `mosquitto` | Controller-managed token file or approved secret provider |
+
+The profiles contain neither a token nor `uns.email`/`uns.password`. For a
+direct host process, copy `.env.example` to `.env`, set a development machine
+token, and keep that file untracked. Controller-managed instances receive the
+mounted token file and controller identity automatically.
 
 For standalone local development, `pnpm run dev` and `pnpm run start` load a
 local `.env` file when it exists. The generated `.gitignore` excludes `.env`
@@ -86,15 +98,18 @@ asset path and `asset` is the leaf sub-asset.
 
 ## Datahub client (last value)
 
-`UnsClient` provides a minimal REST client for the UNS OpenHub API, including the batch last-value endpoint. Prefer a long-lived service token if available; you can pass it directly and skip username/password auth.
+`UnsClient` provides a minimal REST client for the UNS OpenHub API, including the batch last-value endpoint. Prefer the controller-managed token file or a development machine token; do not place it in a tracked config file.
 
 ```ts
-import { ConfigFile, UnsClient } from "@uns-kit/core";
+import { ConfigFile, ServiceTokenProvider, UnsClient } from "@uns-kit/core";
 
 const config = await ConfigFile.loadConfig();
 
+const tokenProvider = new ServiceTokenProvider({
+  configToken: typeof config.uns.token === "string" ? config.uns.token : undefined,
+});
 const client = new UnsClient("https://datahub.example.com", {
-  token: process.env.UNS_SERVICE_TOKEN ?? config.uns.token,
+  tokenProvider,
 });
 
 const values = await client.lastValue([

package/templates/default/config.json

@@ -15,21 +15,9 @@
     "handover": true,
     "jwksWellKnownUrl": "http://localhost:3200/api/.well-known/jwks.json",
     "kidWellKnownUrl": "http://localhost:3200/api/.well-known/kid",
-    "email": "user@example.com",
-    "password": "123"
+    "env": "dev"
   },
   "infra": {
     "host": "localhost"
-  },
-  "output": {
-    "host": "localhost"
-  },
-  "input": {
-    "host": "localhost"
-  },
-  "devops": {
-    "provider": "azure-devops",
-    "organization": "example-org",
-    "project": "example-project"
   }
 }

package/templates/default/gitignore

@@ -38,7 +38,7 @@ tmp-rtt
 !.env.sample
 
 # UNS configuration overrides
-config*.json
+config.json
 
 # Editor files & OS cruft
 .idea/

package/templates/default/package.json

@@ -6,7 +6,7 @@
   "unsDatahub": {
     "schemaVersion": 1,
     "kind": "addon",
-    "controllerCompatibility": ">=7.1 <8"
+    "controllerCompatibility": ">=2 <3"
   },
   "type": "module",
   "engines": {

package/templates/vscode/.vscode/settings.json

@@ -2,7 +2,7 @@
   "npm.packageManager": "pnpm",
   "json.schemas": [
     {
-      "fileMatch": ["config.json"],
+      "fileMatch": ["config.json", "config-*.json"],
       "url": "./config.schema.json"
     }
   ]

package/templates/config-files/config-docker.json

@@ -1,35 +0,0 @@
-{
-  "uns": {
-    "graphql": "http://uns-datahub-controller:3200/graphql",
-    "rest": "http://uns-datahub-controller:3200/api",
-    "processName": "__APP_NAME__",
-    "supervisor": {
-      "enabled": false,
-      "restartOnExit": false,
-      "maxMemoryMb": 512,
-      "restartOnUnhealthy": false,
-      "unhealthyAfterMs": 60000,
-      "restartCooldownMs": 300000
-    },
-    "instanceMode": "wait",
-    "handover": true,
-    "jwksWellKnownUrl": "http://uns-datahub-controller:3200/api/.well-known/jwks.json",
-    "kidWellKnownUrl": "http://uns-datahub-controller:3200/api/.well-known/kid",
-    "email": "user@example-org.com",
-    "password": "secret"
-  },
-  "infra": {
-    "host": "mosquitto:1883"
-  },
-  "output": {
-    "host": "mosquitto:1883"
-  },
-  "input": {
-    "host": "mosquitto:1883"
-  },
-  "devops": {
-    "provider": "azure-devops",
-    "organization": "example-org",
-    "project": "example-project"
-  }
-}